# C1 Cross-Platform + C2-lite Acceptance Checklist

This checklist drives the human acceptance operator through a per-platform
C1 Hello World run plus the C2-lite cross-Station replication scenarios.

- Live PWA (kernel build): `https://benac.benac.dev/`
- Acceptance instrumentation page: `https://benac.benac.dev/acceptance/`
- Required event kinds the instrumentation must capture, per device:
  `page_loaded`, `service_worker_registered`, `station_ready`,
  `capsule_imported`, `trust_approved`, `invocation`, `offline_observed`.
- Server-side acceptance log: `/srv/benac/.gravitational_lens/acceptance_events.ndjson`.
- Acceptance status endpoint: `https://benac.benac.dev/acceptance/status`.

For each device the operator runs, record:

- Build SHA from `health-static.txt` (or footer).
- Captured `User-Agent`.
- Reported station principal(s).
- Captured invocation IDs.
- Whether the run produced all required event kinds.

This is the **C2-lite acceptance scope**. C2-lite covers signed-claim
provenance, public/foreign-inactive replication, and per-Station authority
locality. Full C2 (multi-Station signed-attribution graph, peer trust
delegation) is **out of scope**.

---

## iOS Safari (baseline reference)

This row was captured during the prior C1 closeout and is the baseline.
The operator does not need to re-run iOS unless the build SHA changes.

- Build SHA: see closeout report.
- Captured user-agent: `Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.3 Mobile/15E148 Safari/604.1`
- Captured at: 2026-05-02T16:25–16:27Z.
- Evidence path: `/srv/benac/.gravitational_lens/acceptance_events.ndjson`.
- Acceptance satisfied: yes (all 7 required event kinds observed).

---

## Android Chrome (installed PWA)

- Open `https://benac.benac.dev/acceptance/` in Chrome.
- Tap the install affordance; install Benac as a PWA.
- Open the installed PWA from the home screen (standalone display mode).
- Confirm `health-static.txt` (visible in the page footer) reports the
  expected build SHA.
- Wait for `station_ready`; record the station principal.
- Wait for `service_worker_registered`.
- Switch to the kernel PWA at `https://benac.benac.dev/` (still installed).
- Load the bundled Hello World fixture from `/#/packages` — confirm a
  `capsule_imported` event lands in `/acceptance/status`.
- Approve local no-risk trust from `/#/trust` — confirm `trust_approved`.
- From `/#/invoke` run declarative Hello World — record the invocation id.
- From `/#/invoke` run WASM Hello World — record the invocation id.
- Inspect the latest trace at `/#/traces`.
- Export a trace capsule at `/#/capsules`.
- Disable network on the device.
- Re-open the installed PWA — confirm `offline_observed`.
- Re-run the imported declarative and WASM hello-world invocations — they
  must succeed offline.
- Re-import the exported trace capsule at `/#/capsules` — imported trust is
  visible but inactive.
- Confirm a tampered capsule is rejected (use the negative test page if
  exposed, or hand-edit a copy and re-import).
- Capture `https://benac.benac.dev/acceptance/status` JSON; expect
  `acceptance_satisfied: true` for this device's user-agent.

---

## Ubuntu KDE Firefox

- Open Firefox.
- Navigate to `https://benac.benac.dev/acceptance/`.
- Wait for `page_loaded`, `service_worker_registered`, `station_ready`.
- Record the station principal.
- Switch tabs to `https://benac.benac.dev/`.
- Load the Hello World fixture from `/#/packages`.
- Approve local no-risk trust from `/#/trust`.
- Invoke declarative and WASM Hello World from `/#/invoke`.
- Inspect the trace at `/#/traces`.
- Disable network (Firefox developer tools → Network → Offline).
- Reload the kernel PWA at `https://benac.benac.dev/` — confirm offline
  shell renders.
- Re-run the already-imported declarative and WASM invocations offline.
- Capture `https://benac.benac.dev/acceptance/status` — confirm all 7
  required event kinds are present for this user-agent.

---

## Ubuntu KDE Chrome / Chromium (installable browser Station)

- Open Chrome / Chromium.
- Navigate to `https://benac.benac.dev/`.
- Use the install icon in the address bar to install Benac as a PWA.
- Open the installed Benac window (standalone display mode).
- Browse to `/#/sync` and confirm the C2-lite sync panel renders.
- Open a second tab to `https://benac.benac.dev/acceptance/`.
- Wait for `page_loaded`, `service_worker_registered`, `station_ready`.
- Record the station principal.
- Back in the kernel PWA, run the full C1 sequence:
  load → approve → declarative → WASM → trace inspect.
- Disable network — confirm `offline_observed` and offline reload.
- Capture `https://benac.benac.dev/acceptance/status` for this user-agent.

---

## Ubuntu shell Station CLI

The Station CLI is `benac-station`. Run from a directory the operator owns.

- `benac-station --state ./stations/ubuntu init`
- `benac-station --state ./stations/ubuntu profile --json` — capture the
  station principal.
- `benac-station --state ./stations/ubuntu import ./hello-world.benac-capsule.json`
- `benac-station --state ./stations/ubuntu inspect package --json`
- `benac-station --state ./stations/ubuntu approve hello-world --no-risk`
- `benac-station --state ./stations/ubuntu invoke hello-world --impl declarative` — capture the invocation id.
- `benac-station --state ./stations/ubuntu invoke hello-world --impl wasm` — capture the invocation id.
- `benac-station --state ./stations/ubuntu traces list --json`
- `benac-station --state ./stations/ubuntu traces export --out ./trace.benac-capsule.json`

---

## Cross-Station replication scenarios

Each scenario uses two state directories (`A/` and `B/`) and a relay. The
local relay is the gravitational_lens dev relay
(`http://localhost:8787/relay/v0`). The scenarios are the C2-lite invariants
the human reviewer requested.

### Scenario A — Approved package replicates as inspectable but untrusted

1. On Station A: import + approve hello-world.
2. On Station A: `benac-station --state ./A sync configure --relay <url> --workspace c2lite-acceptance`.
3. On Station A: `benac-station --state ./A sync push --json` — capture
   documents_attempted / documents_applied / blobs_attempted / blobs_verified.
4. On Station B (fresh init): configure same relay + workspace.
5. On Station B: `benac-station --state ./B sync pull --json`.
6. On Station B: `benac-station --state ./B inspect package --json` — the
   package must be present.
7. On Station B: attempt to invoke without local approval — expect `denied`
   with `failure.code = benac.error.missing_trust`. Capture the
   `invocation_id`.

### Scenario B — Foreign authority records arrive marked inactive

1. After Scenario A, on Station B run a `sync pull` that includes the
   foreign-inactive scope (CLI emits authority records as inactive on this
   station).
2. Confirm the `trust_decision`, `capability_grant`, and `auth_session`
   docs that originated on Station A are persisted on Station B with
   `inactive_on_this_station = true` (visible in `sync inspect --json`).
3. Confirm Station B still rejects WASM invocation until a local-user
   gesture creates a Station-B-origin trust + grant.

### Scenario C — Missing-blob denial leaves an invocation receipt

1. Begin from a clean Station B that has pulled documents but **not**
   their accompanying blobs (e.g. the relay was pruned, or B was offline
   during the blob phase).
2. On Station B, attempt to invoke WASM — expect
   `failure.code = benac.error.missing_blob`. Capture the `invocation_id`.
3. The denial trace must be persisted in `traces list --json` on B.

### Scenario D — Tampered-blob rejection

1. Restart Station B from a clean state and pull docs as in Scenario A.
2. Use the dev relay's `/admin/tamper` endpoint (env-gated) to flip a byte
   in the WASM blob.
3. On Station B: `sync pull --json` — confirm the run reports
   `blobs_rejected >= 1` and the rejected blob's `expected_content_id`.
4. The receiver's blob store must NOT contain the tampered bytes.

### Scenario E — Private key material does not leave Station A

1. On Station A: `sync push --json`.
2. Capture the canonical JSON of every doc the relay accepted.
3. Confirm none of the accepted docs has `object_type == "station_keypair"`
   nor a `private_key_base64url`, `raw_secret`, or `raw_credential` field.
4. The conformance suite check
   `private_key_never_in_replication_candidates_for_real_runtime_state`
   already proves this in CI; this scenario is the matching live evidence.

---

## Operator request packet — Android Chrome (installed PWA)

Paste this verbatim as a ticket comment when requesting an Android run.

```
Build SHA: <fill-in from health-static.txt at https://benac.benac.dev/health-static.txt>
URL: https://benac.benac.dev/  and  https://benac.benac.dev/acceptance/
Device/browser: Android phone, Chrome (installed PWA)
Estimated physical action: one pass through the numbered checklist (~5 min)

Steps:
1. Open https://benac.benac.dev/acceptance/ in Chrome.
2. Install Benac via the install affordance and open it from the home screen.
3. Confirm the build SHA in the footer matches the requested SHA.
4. Wait for `station_ready` and `service_worker_registered` to appear in
   https://benac.benac.dev/acceptance/status.
5. Switch to https://benac.benac.dev/, load the bundled Hello World
   capsule from /#/packages.
6. Approve local no-risk trust from /#/trust.
7. Run declarative Hello World from /#/invoke.
8. Run WASM Hello World from /#/invoke.
9. Inspect the latest trace at /#/traces.
10. Disable network on the device.
11. Reopen the installed PWA from the home screen.
12. Re-run declarative and WASM Hello World offline.
13. Re-enable network.

Please report:
- The captured user-agent string.
- The station principal observed.
- The two invocation IDs (declarative, WASM).
- The JSON body of https://benac.benac.dev/acceptance/status filtered to
  this user-agent.
- Whether `acceptance_satisfied` was true.
```

---

## Operator request packet — Ubuntu KDE Firefox

```
Build SHA: <fill-in from https://benac.benac.dev/health-static.txt>
URL: https://benac.benac.dev/  and  https://benac.benac.dev/acceptance/
Device/browser: Ubuntu 24.04 (KDE), Firefox (browser tab)
Estimated physical action: one pass through the numbered checklist (~5 min)

Steps:
1. Open https://benac.benac.dev/acceptance/ in Firefox.
2. Wait for page_loaded, service_worker_registered, and station_ready.
3. Switch to https://benac.benac.dev/.
4. Load the bundled Hello World capsule from /#/packages.
5. Approve local no-risk trust at /#/trust.
6. Run declarative Hello World from /#/invoke.
7. Run WASM Hello World from /#/invoke.
8. Inspect the latest trace at /#/traces.
9. Open Firefox devtools → Network → Offline.
10. Reload https://benac.benac.dev/.
11. Re-run already-imported declarative and WASM Hello World offline.
12. Re-enable network.

Please report:
- The captured user-agent string.
- The station principal observed.
- The two invocation IDs (declarative, WASM).
- The JSON body of https://benac.benac.dev/acceptance/status filtered to
  this user-agent.
- Whether `acceptance_satisfied` was true.
```

---

## Operator request packet — Ubuntu KDE Chrome / Chromium (installable browser Station)

```
Build SHA: <fill-in from https://benac.benac.dev/health-static.txt>
URL: https://benac.benac.dev/  and  https://benac.benac.dev/acceptance/
Device/browser: Ubuntu 24.04 (KDE), Chrome / Chromium (installed PWA)
Estimated physical action: one pass through the numbered checklist (~5 min)

Steps:
1. Open https://benac.benac.dev/ in Chrome / Chromium.
2. Install Benac via the address-bar install affordance.
3. Open the installed Benac window in standalone mode.
4. Browse to /#/sync and confirm the C2-lite sync panel renders.
5. Open a second tab to https://benac.benac.dev/acceptance/.
6. Wait for page_loaded, service_worker_registered, and station_ready.
7. Switch back to the kernel PWA tab.
8. Load the bundled Hello World capsule from /#/packages.
9. Approve local no-risk trust at /#/trust.
10. Run declarative Hello World from /#/invoke.
11. Run WASM Hello World from /#/invoke.
12. Inspect the latest trace at /#/traces.
13. Disable network (devtools → Network → Offline).
14. Reload the installed PWA — confirm offline shell renders.
15. Re-run the imported declarative and WASM Hello World invocations.
16. Re-enable network.

Please report:
- The captured user-agent string.
- The station principal observed.
- The two invocation IDs (declarative, WASM).
- The JSON body of https://benac.benac.dev/acceptance/status filtered to
  this user-agent.
- Whether `acceptance_satisfied` was true.
- A note on whether /#/sync rendered and the install flow succeeded.
```
